Process Object: Requiring either PID or UID

[tankbusta]

Problem

The process object that is used in almost every System Activity classes requires the Operating System PID to be set on every event. To combat PID reuse [1], most vendors with endpoint agents/tools generate their own Unique ID for a process and may send it instead on subsequent events (say a new library being loaded Module Activity or a file being written File System Activity).

Solution

To solve this, we're recommending that PID be changed from required to recommended with a constraint that either pid or uid be set. In this week's triage call, we also talked about renaming uid with an updated description change to make it more clear.

References

• [1] https://devblogs.microsoft.com/oldnewthing/20110107-00/?p=11803

[awhite456]

Removing the PID prevents correlation with non-EDR data sources. As an example, apache by default provides a PID in its log messages. If process creation events only have a uid, how would someone investigating malicious activity correlate the apache process in the log to the responsible process creation event?

As for renaming uid, I agree with that - it overlaps with user id for linux events.

Ideally, we should have both the PID and UID as required for process creation events, with a function for generating UIDs when the source does not provide it, eg f(device_id + timestamp + pid)

[tankbusta]

@awhite456 The OS PID should always be set on process creation event but due to limitations in OCSFs constraint system, we cant enforce this.

This proposal is mostly for the other types of System Activity events where the endpoint tool may send its own interpretation of the PID instead on File Writes, Library Loading, etc.

[awhite456]

Right ok, I can understand that. Will change my vote

[tankbusta]

Wrapping up this proposal.

Everyone is in favor of changing the constraint but leaving uid with an updated description had more votes.

[JasonKeirstead]

Even if the UID is sent, the PID should still be required. A process object without a PID is incomplete.